Getting Data In

Splunk adds .filepart to file name

AlexMcDuffMille
Communicator

Hello,

I put about 500 files on a server (between 2 directories) and was looking through the data. It seemed that most of the files were broken up line by line, but some of the files were not broken up and were saved as single events with multiple lines. Also, the source for some of the events were changed from the original file name (example1.log) to filename.filepart (example1.log.filepart).

Does anyone know what the .filepart means?

Thanks!

Tags (1)
0 Karma
1 Solution

Ayn
Legend

This is not due to anything Splunk does, but more likely because you've used some kind of file transfer software to transfer files to a directory Splunk is monitoring. WinSCP for instance will do this - while the file is transferred it will be called <filename>.filepart, then when the transfer is complete the file will be renamed to the original filename. Splunk will however pick up data directly when it appears, that is, before the file transfer is complete, and so will pull data while the file is still called <filename>.filepart.

View solution in original post

Ayn
Legend

This is not due to anything Splunk does, but more likely because you've used some kind of file transfer software to transfer files to a directory Splunk is monitoring. WinSCP for instance will do this - while the file is transferred it will be called <filename>.filepart, then when the transfer is complete the file will be renamed to the original filename. Splunk will however pick up data directly when it appears, that is, before the file transfer is complete, and so will pull data while the file is still called <filename>.filepart.

Ayn
Legend

Sure, you can use blacklists in inputs.conf. Have a look at the docs: http://docs.splunk.com/Documentation/Splunk/6.0/admin/inputsconf

So for instance

[monitor:///some/directory]
blacklist = \.filepart$
0 Karma

AlexMcDuffMille
Communicator

Is there anyway to prevent this from happening? I guess in the future I'll be sure to make sure it's uploaded before changing my inputs.conf to include the directory.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...